BaseBros Fi, a yield-optimizing decentralized finance (DeFi) protocol on the Base blockchain, has disappeared from the internet after stealing users’ investments via unaudited smart contracts.
On September 13, BaseBros deleted its official website and social media accounts on X and Telegram. Blockchain security firm Chain Audits, which previously audited some of BaseBros’ smart contracts, found that the DeFi project organized its carpet pool through an “unaudited and unverified Vault contract.”
source: I’m from BrosFi
BaseBros had around 2,000 followers on X and over 3,300 members on Telegram before disappearing.
Vulnerable smart contracts have been audited.
ChainAudits claims to have audited four out of five smart contracts used in the BaseBros project, adding:
“Unfortunately, the contract that facilitated the rug pull (the Vault Contract) was not included in the scope of our audit and was not verified on the blockchain.”
The unaudited contract contained a backdoor vulnerability that allowed the company owner to withdraw funds deposited into the ‘strategy’ contract.
source: Chain Audit
BaseBros rug pool did not affect Seamless protocol.
The rug pull incident was initially incorrectly assumed to affect the Seamless protocol due to similar contract labels. According to blockchain researcher Cyvers, malicious actors were able to siphon off $130,000 worth of stolen funds via the cryptocurrency mixing service Tornado Cash.
source: Cybers
Seamless conducted an internal investigation and declared the protocol and investor funds safe from all attacks. Chain Audits also confirmed that BaseBro Fi was the only protocol that lost funds from multiple pools.
relevant: Indonesian Cryptocurrency Exchange Indodax Goes Offline After Suspected $22 Million Hack
Recently, a seasoned hacker identified the attacker who hacked DeFi protocol Penpie for $27 million.
Penpie hacker received an on-chain thank you message from Euler Finance hacker who stole $195 million in March 2023.
“Good job, bro. I’ve seen hacks like this before. You’re lucky you took all the money so these guys never got a single dollar back that you stole. You won, they lost. Good job.”
However, the Euler Finance hackers returned 90% of the stolen funds in exchange for legal immunity and a 10% reward.
magazine: Proposed Change Could Break Ethereum Out of L2 ‘Roadmap to Hell’